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This application claims the benefit of U-S. Provisional Patent Application 
Serial No. 60/346,302 filed on January 9, 2002. 

Field of the Invention 

The invention relates generally to aircraft security and more particularly to the 
security of the flight deck (cockpit). 

Background of the Invention 

Recently there have been incidents involvmg enormous loss of life wherein 
suicide hijackers have conmiandeered jetliners and deliberately flown them into 
buildings, killing everyone on board as well as thousands of innocent people on the 
groimd. In at least one case it was suspected that the hijackers took over the flight 
deck prior to take-off, and that a hijacker wearing a pilot's uniform was at the 
controls. For many years hijacldng was considered more of an inconvenience than a 
danger, however it has taken on a new dimension with the emergence of suicide 
hijackers determined to use aircraft as guided bombs. 

While hijacking is the most serious flireat to commercial aviation, a secondary 
but more prevalent danger involves "air rage" incidents wherein unruly, intoxicated or 
deranged passengers assault flight attendants, often attempting to enter the flight deck 
to harass or assault the pilots. 

In reaction to the hijacking events the U.S. Federal Aviation Administration 
mandated a new style of bullet-proof cockpit door designed to increase cockpit 
security. The security requirements for the cockpit door for preventing terrorists from 
forcefully entering the flight deck are becoming increasingly stringent, for instance 
the locked door must withstand up to about SOOkgf However, even such a reinforced 
coclq)it door will not prevent terrorists firom rushing the door when it is opened to 
allow a member of the aircrew to enter or exit the flight deck. While the new door 
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has made cockpit intrusion more difficult for unruly passengers, it has actually made 
hijackmg easier and safer for the trained terrorist. 

Experience has shown that terrorist hijackers do not normally force coc]q)it 
doors open» but wait until someone unlocks the door during the normal course of 
flight, then seize the opportunity to rush onto the flight deck and overpower the pilots. 
By commandeering the aircraft in this way, terrorists require no weapons but simply 
need to lay in wait and move quickly when the opportunity presents itself. Adding to 
the danger is the fact that, once flight deck entry is gained, intruders can close the 
cockpit door and use it to protect themselves from passengers and security persortael 
in the cabin. By using the new fortified door to their advantage, they are able to turn 
the flight deck into a fortress within which they can operate the aircraft without 
interference. Because of the speed and precision with which this action is executed 
by trained terrorists, it is £5)parent that no security guard or weaponry can be relied 
upon to stop this type of intrusion in every case. 

Because the new cockpit door, standing alone, provides protection to the flight 
deck only when it is locked, certain airlines have taken the added precaution of 
installing a second door spaced from the cockpit door. The second door is to be closed 
20 so that a member of the flight crew camiot be observed entering or exiting the flight 

deck by the passengers and therefore terrorists would riot know when to rush the door. 
Such an arrangement is shown schematically in US Patent Application PubUcation 
No. US2000/0092951 published on July 18, 2002. Though this arrangement may 
provide at least an illusion of higher security, the cost of installing a further 
25 permanent door with the accompanying wall structures in all aircraft would be 

prohibitive and such a permanent structure in front of the locked cockpit door in the 
washroom/galley area would be highly inconvenient since it would impede the 
legitimate movement of the aircrew and passengers in HhdX section of the plane. 
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Flight deck security is no longer an option, but a serious life-and-death 
requirement on passenger aircraft, particularly higher capacity aircraft capable of 
relatively long distance flights. 
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Therefore, there is an urgent need for a system and a process by which 
intruders are prevented from accessing the flight deck of an aircraft. 

5 Summary of the Invention 

The invention is directed to an aircraft flight deck security system comprising 
a secure closable isolation curtain moimted in the aircraft cabin to form a barrier for 
entry to the flight deck when closed, a device for viewing a zone in the aircraft 
adjacent to the closed isolation curtain and a mechanism for closing and retracting the 
10 isolation curtain. The viewing device may be an opening in the isolation curtain or 

altemately a video camera in the aircraft cabin connected to a video monitor on the 
flight deck. 

In accordance with another aspect of the invention, the aircraft flight deck 
15 security system comprises a secure closable isolation curtain adapted to be mounted in 
the aircraft cabin to form a secure zone outside of a lockable cockpit door to the flight 
deck, a unit for viewing the secure zone from the flight deck and a controller on the 
flight deck for controlling the operation of the isolation curtain, 

20 In accordance with a further aspect of the invention, the aircraft flight deck 

security system comprises a secure closable isolation curtain mounted in the aircraft 
cabin to form a secure zone outside of a lockable cockpit door to the flight deck, a 
imit for identifying a person located in the secure zone and a controller on the flight 
deck for controlling the operation of the isolation curtain. 

25 

In accordance with another aspect of the invention, the person identification 
imit may be a biometric identification imit such as a fingerprint scaimer adapted to be 
mounted in the secure zone and coupled to the controller. The viewing unit may be at 
least one video camera in the secure zone connected to a video monitor on the flight 
30 deck 

In accordance witihi further specific aspects of the invention, the controller can 
be coupled to a sensor for providing the status of the lockable cockpit door and a 
mechanism for causing the cockpit door to unlock. The system may further include a 
35 sensor for detecting the presence of a person in a lavatory that opens into the secure 
zone, as well as indicators in the secure zone and on the flight deck for indicating the 
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presence of a person in the lavatory. An electronic mechanism including an electrical 
motor under tiie control of the controller can be used to close and/or retract the 
curtain, hidicator lights can be mounted on or near the isolation curtain for alerting 
that ttie curtain is closing or retracting, and sensors also coupled to the controller can 
5 be mounted on a leading edge of the isolation curtain to detect any object that is in the 

path of the closing curtaiiL The curtain can also have a locking mechanism coupled to 
the controller means for locking the isolation curtain in the closed position. 

In accordance with yet another aspect of this invention, the process under the 
10 control of a pilot for permitting entry to an aircraft flight deck where the aircraft has a 

lockable coclqpit door to the flight deck and a lockable isolation curtain mounted to 
provide a secure zone in the aircraft cabin adjacent the cockpit door, comprises the 
steps of receiving an indication of a person's desire to enter the flight deck, verifying 
that the person is alone in the secure zone, closing the isolation curtain, unlocking the 
15 cockpit door, allowing the person to enter the flight deck and closing and locking the 

cockpit door. The curtain can be unlocked and retracted once the cockpit door is 
locked. If a lavatory opens into the secure zone, the occupancy of the lavatory is also 
verified before imlocking the cockpit door. 

20 In accordance with a further aspect of the invention, the process under the 

control of a pilot for pemaitting aircrew entry onto an aircraft flight deck where the 
aircraft has a lockable cockpit door to the flight deck and a lockable isolation curtain 
mounted to provide a secure zone in the aircraft cabin adjacent the cockpit door, 
comprises receiving confirmation that the person seeking entry is a member of the 

25 aircrew, closing the isolation curtain, verifying that the person is alone in the secxu-e 

zone, unlocking the cockpit door, allowing the aircrew member to enter the flight 
deck and closing and locking the cockpit door. The curtain can then be imlocked and 
retracted once the cockpit door is locked. This process can- further include verifying a 
biometric characteristic of the person seeking entry and comparing the biometric 

30 characteristic to the biometric characteristic data of the aircrew. The biometric 

characteristic can be a fingerprint of the person. If a lavatory opens into the secure 
zone, the occupancy of the lavatory is also verified before unlocking the cockpit door. 



35 



In accordance witii another aspect of the invention, the process under the 
control of a pilot for exiting an aircraft flight deck where the aircraft has a lockable 
cockpit door to the flight deck and a lockable isolation curtain mounted to provide a 
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secure zone in the aircraft cabin adjacent the cockpit door, comprises closing and 
locking the isolation curtain, verifying fliat no one is in the secure zone, unlocking the 
cockpit door, exiting the flight deck and closing and locking the cockpit door. The 
curtain can then be unlocked and retracted once the cockpit door is locked. If a 
5 lavatory opens into the secure zone, the occupancy of the lavatory is also verij&ed 

before xmlocking the cockpit door. If the person exiting the flight deck wishes to use 
tiie lavatory, the person may do so without closing and locking the cockpit door, as 
long as the person returns to the flight deck. 

10 In accordance with yet another aspect of the invention, the system under the 

control of a pilot for permitting entry to an aircraft flight deck where the aircraft has a 
lockable cockpit door to the flight deck and a lockable isolation curtain mounted to 
provide a secure zone in the aircraft cabin adjacent the coclq)it door, comprises a 
device for providing the pilot an indication of a person's desire to enter the flight 

15 deck, a unit for verifying that the person is alone in the secure zone, a mechanism for 

closing the isolation curtain, and a mechanism for unlocking tiie cockpit door to allow 
the person to enter the flight deck and then for closing and locking the cockpit door. 
The system can further include a sensor for determiiiing the occupancy of a lavatory 
that opens onto the secure zone. 

20 

In accordance with a further aspect of the invention, the system imder the 
control of a pilot for permitting aircrew entry to an aircraft flight deck where the 
aircraft has a lockable cockpit door to the flight deck and a lockable isolation curtain 
moimted to provide a secure zone ia the aircraft cabin adjacent ttie cockpit door, 

25 comprises a unit for providing the pilot confirmation that the person seeking entry is a 

member of the aircrew, a mechanism for closing the isolation curtain, a unit for 
verifying that the person is alone in the secure zone, and a mechanism for unlocldng 
the cockpit door to allow the aircrew member to enter the flight deck and then for 
closing and locking the cockpit door. The unit for providing the pilot an indication 

30 that the person seeking entry is a member of the aircrew can iaclude a sensor for 

determining the occupancy of a lavatory that opens onto the secure zone. The system 
may further include an identification unit for verifying a biometric characteristic of 
the person seeking entry and for comparing the biometric characteristic to the 
biometric characteristic data of the aircrew. The biometric characteristic can be the 

35 person's fingerprint 
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In accordance with another aspect of the invention, tiie system under the 
control of a pilot for a person to exit an aircraft flight deck where the aircraft has a 
lockable cockpit door to the flight deck and a lockable isolation curtain moimted to 
provide a secure zone in the aircraft cabin adjacent the coclqpit door, comprises a 
5 niechanism for closing and locking the isolation curtain as well as for unlocking and 
retracting the curtain, a unit for verifying that no one is in the secure zone, a 
mechanism for imlocking the cockpit door for the person to exit the flight deck and 
for closing and locking the coclqpit door. The system can further include a sensor for 
determining the occupancy of a lavatory that opens onto the secure zone, 

10 

. . In accordance with yet another aspect of this invention, the secure isolation 
curtain for an aircraft comprises a flexible mechanically strong sheet material having 
a top, a bottom and two sides, a first track adapted to be fixed to the aircraft ceiling, a 
second track adapted to be fixed to the aircraft floor, mounting elements for securing 

15 ttie top of the material to the first track so as to be movable within the track, mounting 

elements for securing the bottom of the material to the second track so as to be 
movable within the track, a mounting device adapted to fix one side of the material to 
a first aircraft wall, a locking mechanism adapted to secure the otiier side of the 
material adjacent to a second aircraft wall and a drive mechanism for moving the 

20 second side of the material firom a position adjacent the first aircraft wall to a i^osition 
adjacent the second aircraft wall. 

Li accordance with specific aspects of this invention, the mounting device for 
fixing the one side of the material comprises a container for receiving the flexible 
25 sheet material when it is retracted. In addition, the drive mechanism comprises a 

motor driving a pulley mechanism for opening and retracting the curtain material. 
Retracting the curtain can be done by a spring-loaded vertical shaft that retracts the 
curtain material into the container. The curtain can further include an indicator 
mounted near the other leading side of the material to indicate that the ciu^ain is about 
30 to close or retract, and a sensor moxmted near the other side of the material to detect 

' any obstruction to the movemCTit of the curtain. 

Other aspects and advantages of the invention, as well as the structure and 
operation of various raibodiments of the invention, will become apparent to those 
35 ordinarily skilled in the art upon review of the following description of the invention 

in conjvmction with the accompanying drawings. 
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Brief Description of the Drawings 

The invention will be described with reference to tiie accompanying drawings, 
wherein: 

5 Figure 1 is a top isometric view of the isolation curtain located in an aircraft 

cabin in accordance with the present invention. 

Figure 2 is a front view of the isolation curtain; 

Figure 3 is a schematic view of the Crupax flight deck security system (FDSS) 
including the aircraft lavatory in accordance with the present invention; 
10 Figure 4 is a block diagram of the Cmpax FDSS; 

Figure 5 is a schematic view of the Crupax flight deck security system (FDSS) 
excluding the lavatory; 

Figure 6a to 6d represent different curtain track configurations; 

Figure 7 illustrates a security level 2 flight deck entry process; 
15 Figure 8 illustrates a security level 2 flight deck entry process when the 

lavatory is in the secure zone; 

Figure 9 illustrates a security level 3 flight deck entry process; 

Figure 10 illustrates a security level 3 fligjht deck entry process when the 
lavatory is in the secure zone; 
20 Figure 1 1 illustrates flight deck entry process for a non-aircrew member; 

Figure 12 illustrates flight deck exit process for the pilot; 

Figure 13 illustrates flight deck exit process for the pilot using the lavatory in 
the secmre zone; and 

Figure 14 illustrates a system for acquiring and transfening aircrew biometric 

25 data. 



Detailed Description of tlie Invention 

The present invention is directed to increasing coclq)it security in 
support of, and in conjunction with, the new FAA mandated bullet-proof cockpit 
30 door. This is accomplished by the Crupax Flight Deck Secmity System (FDSS), 

which provides a physical barrier that cannot be penetrated by unauthorized persons 
while the cockpit door is unlocked. Rather than use a second solid door, which is 
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much too heavy and expensive to install in aircraft, Crupax FDSS incorporates a 
lightweight isolation curtain that keeps all intruders at a safe distance whenever the 
cockpit door is vulnerable. In using the term curtain, it is understood that it is meant 
to include any type of flexible barrier that can be rolled, folded or other such that it 
5 may be extended along tracks or guides to close an opening. 

Crupax FDSS requires that all persons desiring cockpit entry must, in every 
case, be positively identified as bona fide aircrew members by an identification 
method, or alternatively by being personally known to the pilots, before they are able 

10 to gain entry to the cockpit. The pilots have fiill control of the system, and must 
approve each entry or exit operation. The pilots have system override capability, 
however they must be carefiil how they exercise that function as it may expose them 
to unseen dangers. Any circumvention of the system niay be recorded for audit 
purposes, thereby preventing flight crews from becoming complacent or bypassing 

15 the system routinely. 

Because of the many different aircraft types and models, Cmpax FDSS may 
have different configurations incorporating varying levels of security for installation 
.in different types of aircraft. For example, a small coromuter aircraft with little 

20 passenger capacity and no fUght attendants does not, in many cases, have even a basic 
cockpit door. The Cmpax isolation curtain, manually or electrically operated, can fill 
this void very effectively. As well, a large cargo aircraft with no passenger seats can 
be outfitted with a similar isolation curtain system. Larger passenger aircraft, on the 
other hand, will require a much higher level of security having a motorized isolation 

25 curtain with video camera and biometric identification systems as methods of 
identification. 

The basic component of tiie FDSS is a retractable flexible isolation curtain 1, 
illustrated schematically in figures 1 and 2, that may be installed in existing aircraft or 
30 in new aircraft to provide a physical barrier to anyone trying to enter the flight deck of 

an aircraft whether the fli^t deck has a cockpit door 2 that is open, or only an 
opening 2a to the flight deck from the aircraft cabin. The retractable curtaia 1 includes 
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mountmg elements 3 that movably connect the curtain 1 to tracks or guides 4 that are 
securely fixed to the aircraft cabin ceiling 5 and floor 6. The retractable isolafion 
curtain 1 travels securely within the tracks 4 to form a secure zone 7 at the opening 2a 
to the flight deck or in front of the cockpit door 2. When the curtain 1 is closed, the 

5 mounting elements 3 prevent anyone from sUpping underneath or reaching over the 
top of the curtain 1. When retracted, the isolation curtain 1 rolls or folds inside a 
container 8 such as a roll-up tube, which may be as small as 3" in diameter depending 
on the thickness and materials used in the curtain 1. The container 8 is moxmted 
vertically on the wall 9 outside the cockpit door 2. In aircraft having cockpit doors 2, 

10 it is preferred to have the curtain 1 tracks 4 fixed in the order of three feet from the 

cockpit door 2 to provide just enough space for a flight attendant carrying a tray to 
stand comfortably in the secure zone 7 between the curtain 1 and the cockpit door 2 
while awaiting lentry to the flight deck or exit from the secure zone 7. 

15 The curtain 1 may be operated manually whereby a member of the aircrew 

may close and lock the curtain from the flight deck side of the curtain 1 using a 
manual locking mechanism. Alternately, the curtain may include a motor 1 0 located 
in the container 8 with a system for unrolling the curtain 1 from the container 8 and 
for retracting the curtain 1 back into the container 8. The curtain 1 locks in the closed 

20 position using an electrically controlled lock such as a number of solenoids 14. The 

controls 1 1 for closing and retracting the curtain 1 would be located on the wall 9 on 
either side of the cockpit door opening 2a on the flight deck side of the closed cxirtain 
1. In either case, the security curtain 1 has a fail-safe feature allowing it to be opened 
manually from the flight deck side in case of equipment failure. The curtain 1, when 

25 not in use, retracts into container 8 so that it does not interfere with flight attendants 
working in the area outside the cockpit door 2 or will not needlessly take up space so 
as not to impede the entrance or exit of passengers from the aircraft. 

The isolation curtain 1 is made fix>m a mechanically strong security material 
30 which may include aramid fibres and which may be reinforced to prevent cutting or 

tearing. The reinforcement may be an embedded steel mesh, resulting in a strong, 
lightweight and yet flexible curtain 1. An example of such a material is described in 
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the UK Patent Application No 0203151.6 filed on February 11, 2002 by flie Bradbxiry 
Group Ltd. and entitled "Improvements in or relating to Flexible Barriers". 

The security curtain 1 described above is attached to the tracks 4 iu such a 
5 mamier so as to allow sufficient air passage so that it will not be blown out by rapid 
cabin decompression. As a safety measure, one or more warning lights 12 may be 
situated on the leading edge of the curtain 1 or near the curtain 1 to alert flight 
attendants in the vicinity of its imminent deployment so that they do not accidentally 
coUide with the curtain or hinder its operation. In motorized versions, the curtain 1 
10 may also include a sensor 14 on the forward edge of the curtain 1 so that it will 

automatically retract when the leading edge contacts an obstruction, thereby 
preventing injury to anyone getting in the way. Further, the curtain 1 is installed so 
that it does not interfere with access to wall-moimted appliances when retracted. 

15 The curtain 1 location and configuration will vary with different aircraft 

designs so that the tracks or guides 4 may be straight across a hallway as shown in 
figure 6a, diagonal across a hallway as shown in figure 6b, cxurved across a hallway in 
front of the cockpit door opening 2a as shown in figure 6c or in some combination of 
the above as shown in figure 6d. Whatever the configuration, the isolation curtain 1, 

20 which travels in the tracks 4 seals off a secure zone 7 near the cockpit door 2 or 

opening 2a. 

When extended, the curtain 1 will securely seal off a seciire zone 7 
immediately outside the cockpit door opening 2a. For aircraft without cockpit doors, 
25 the curtain 1 will secure the flight deck from intmders. For an aircraft with a cockpit 

door 2, an aircrew member wishing to eater the flight deck and standing in front of 
fixe cockpit door opening 2a need not worry about an intruder sneaking onto the flight 
deck or rushing the cockpit door 2 while it is open. The curtain 1 creates a secure 
zone 7 that allows the cockpit door 2 to be opened safely. 

30 

The Crupax Fli^t Deck Security System (FDSS) 30 will be described in 
conjunction with figures 3, 4 and 5. The FDSS 30 comprises the isolation curtain 1 
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that is adapted to seal off a secure zone 7 in the aircraft cabin 3 1 next to the cockpit 
door 2 to the flight deck 32, an identity verification unit (lU) 33 located within the 
secure zone 7 preferably just outside the coclq)it door 2 and a computer controller 34 
located on the flight deck 32. 

5 

The controller 34 senses the status of the lock on the cockpit door 2, and operates 
the isolation curtain 1 and the EJ 33, An interface 37 is associated with the controller 
34 on the flight deck 32 to permit the pilot to control the operation of the FDSS 30. 
Interface 37 may include control buttons and a keyboard for operating the system 30 

10 and a speaker for giving warning signals to the pilot. The interface 37 control buttons 

may be located on a small control console where, for example, two function buttons 
are identified by different colors such as red and green, the red button for unlocking 
the cockpit door 2, while green button for closing and retracting the isolation curtain 
1. The existing cockpit door lock imlocking control mechanism on an aircraft may be 

15 used as part of the red button control system. It is desirable to have the cockpit door 2 
lock and the curtain control interlocked so that the pilot is warned not to unlock the 
cockpit door 2 when the curtain 1 is not fully closed and locked. This may be done 
electronically by an alarm buzzer or visually by having the red button Ut when the 
cockpit door 2 is unlocked and the green button lit when the curtain is not closed and 

20 locked. 

Once the cockpit door 2 is locked, the pilot is able to open the cockpit door 2 
by unlocking it using the red button on the interface 37 or manually under emergency 
conditions, i.e. when the controller 34 is inoperative. 

25 

The curtain 1 is adapted to be normally retracted into the container 8 and out 
of the way when the cockpit door 2 is locked, but is further adapted to close and 
remain closed in certain predetermined situations so that no one outside of the flight 
deck 32 and particularly outside of the secure zone 7 is able to open it. The controller 
30 34 further automatically operates the warning lights 12 when the isolation curtain 1 is 

about to close and automatically retracts the isolation ciirtain 1 when it contacts an 
obstraction while closing. 
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The controller 34, which is connected to the identity verification unit 33 by a 
hidden cable, receives the biometric data for the user of the identity verification unit 
33. The data is compared to biometric data stored in flie controller 34 to determine 
5 whether to close the isolation curtain 1. Further the isolation curtain 1 may be 

retracted through the controller 34 or manually from the flight deck side of the curtain 
1. The identity verification imit 33 may be any of a mmiber of biometric imits that 
can determine the identity of a person by some imique physical characteristic of that 
person such as fingerprints, iris, DNA, facial recognition or other in order to uniquely 
10 and positively identify an individual. 

In addition, the controller 34 is linked to a communications device 42 for 
receiving biometric and other data either physically through discs or the like, or 
through a secure Litemet link, as will be described below. As illustrated in figures 3 
15 and 4, the controller 34, the interface 37, the communications device 42 and the video 

monitor 35 are located on the flight deck 32, and may be mounted on the rear wall of 
the flight deck 32 of each aircraft or at some other appropriate location. 

A video camera 36 is mounted in the area immediately outside the cockpit 
20 door 2 to provide the pilot with a cleetr view of the person who is requesting cockpit 

entry and is being identified by the identity verification imit 33, and to confiim that 
the person is alone in the secure zone 7 after the curtain 1 has closed. Live video 
from the camera 36 is displayed on a video monitor 35. The video camera system 35, 
36 may operate independently from the controller 34. In aircraft designed in such a 
25 way that one camera 36 cannot give a satisfactory view of the whole secure zone 7 

outside the cockpit door 2, one or more additional cameras may be required. In such a 
case, the video monitor 35 inside on the flig^ht deck 32 will have a split screen to 
provide all views simultaneously. 

30 In the Crupax FDSS 30 illustrated in figures 3 and 4, the lavatory 38 is within 

the secure zone 7 encompassed by the curtain 1 when it is closed, while the Crupax 
FDSS 30 in figure 5 does not have a lavatory 38 in the secure zone 7. When the 
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lavatory 38 is in the secure zone 7, a lavatory occupancy sensor 39 is located in the 
lavatory 38 and is connected to two red flashiag indicator lights 40, 41, which are 
activated when the presence of a pferson is sensed inside the lavatory 38. One of the 
indicator lights 40 is located on tiie hallway wall near identity verification unit 33 and 
5 tiie second light 41 is located near the video monitor screen 35 on the flight deck 32. 

The lavatory sensor 39, flashing light 40, 41 system may be an independent 
stand alone system, which the pilot is required to monitor when someone is requesting 
entry onto the flight deck 32, however, it is preferred that the system be connected to 

10 the controller 34 to prevent any possible security breaches. For instance, an alarm 

buzzer may also be made to sound on the interface 37 and a large red "X" may be 
made to flash on the monitor screen 35 to warn the pilot against opening the cockpit 
door 2 if somepne is requesting entry onto the flight deck 32 while a p^son is in the 
lavatory 38. In addition, the isolation curtain 1 may be programmed to be able to be 

15 retracted but will not close while the lavatory 38 is occupied, this being the only case 

in which Ihe pilot does not have complete system override capability. This prevents 
an intruder from hiding undetected in the washroom while waiting for the cockpit 
door 2 to open. While a flight attendant is in the secure zone 7, an intmder cannot 
also be in the secure zone 7 without the attendant's knowledge, nor wait in the 

20 lavatory 38 for the cockpit door 2 to open without the pilot's knowledge. 

The FUght Deck Security System 30 is always imder the control of the pilot or 

other flight crew member on the flight deck 32. Once the flight crew has entered the 

aircraft flight deck 32, the pilot will activate the FDSS 30. 

» 

25 

After the FDSS 30 is activated, an aircrew member wishing to enter the flight 
deck 32, must position him/herself in the secure zone 7 outside the coc]q>it door 2, 
where the lU 33 will determine his/her identity through biometric identification. 
When positive identification is made, the isolation curtain 1 closes automatically, 
30 creating the secure zone 7 between the curtain 1 and the cockpit door 2. 

Simultaneously, the interface 37 sounds a single chime on the flight deck 32, 
indicating to the pUot that a person who has been authenticated 2is a bona fide aircrew 
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member, is awaiting entry. The pilot will then view the potential entrant on the 
monitor 35 to ensure the person is alone in tiie secure zone 7 and not under duress. 
Upon being satisfied that it is safe to do so, the pilot will unlock the coclq)it door 2 by 
pressing the red button on the interface 37 console. The pilot has a manual override 
5 capability enabling him/her to unlock the cockpit door 2 and open the isolation curtain 
1 simultaneously in an emergency by pressing simultaneously on the red and the 
green buttons on the interface 37 console, however this action will activate an alarm 
buzzer on the interface 37. 

10 If verification fails, a series of two chimes alerts the pilot to a possible 

intrusion attempt and the isolation curtain 1 does not close. In such a case the 
. controller 34 niay store the biometric data obtained from the failed attempt for fixture 
investigation. 

15 When a pilot wishes to exit the flight deck 32, he/she will first check tibie 

monitor 35 to ensure the seciire zone 7 outside the cockpit door 2 is unoccupied, then 
using the interface 37, close the isolation curtain 1 by pressing the green button. 
He/she then checks the monitor 35 to ensure that the curtain 1 is closed and that the 
secure zone 7 is vacant, unlocks the cockpit door 2 by pressing the red button 

20 allowing the pilot to enter the secure zone 7. The cockpit door 2 is locked behind the 

pilot, after which the isolation curtain 1 opens automatically providing the pilot access 
to the aircraft cabin 31. 

Pilots wishing to admit persons other than on-duty aircrew onto the flight deck 
25 32 may do so by arranging via intercom for the visitor(s) to stand near the cockpit 
door 2, then closing the isolation curtain 1 by pressing the green button to establish 
the secure zone 7. The pilot then checks the video monitor 35 and unlocks the coclqpit 
door 2 by pressing the red button. Pilots maintain fiiU control over who enters the 
flight deck 32, thereby enabling them to interact with anyone on the aircraft if they 
30 feel safe in admitting that person(s). Visitors might include fellow airline employees, 

family or fiiends. Pilots can admit anyone they choose with no lapse in flight deck 
32 security. They can also circumvent the FDSS 30 whenever they wish, but assume 
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full responsibility for any risks incurred as a result. Pilots have total control and 
override capability of the system 30 with the exception noted above, but their actions 
may be recorded for future reference. 

5 A door 2/curtain 1 interlock protocol in the controller 34 ensures that 

the cockpit door 2 and security curtain 1 are never open at the same time without the 
knowledge of the pilot, thereby makfaig it physically impossible for aircrew to 
inadvertently leave the cockpit door 2 open to iatruders. To unlock the door 2, the 
pilot must press the red button on the interface 37 console. If he/she pushes the red 
10 button before the isolation curtain 1 is securely locked, a large red "X" hiay be made 

to cover the monitor screen 35 and a loud alarm buzzer may be made to sound on the 
interface 37 speaker. The pilot may choose to ignore this warning and open the door 
2 by pressing the red button again within a predetermined time if he/she wishes to 
exercise tiie system override capability in an emergency. 

15 

The controller 34 may further include a protocol by which all FDSS 30 
activities during a flight are recorded. From the time of engine start-up until 
shutdown, each Crapax FDSS 30 action may be automatically recorded for future 
reference. This provides a check system so that airline companies can monitor how 
20 the system is being used, ensuring proper deployment of the system on all flights and 

providing an accurate record of events as they occur. 

The Cmpax FDSS 30 is designed with an open architecture that will allow for 
easy upgrade as new technologies become available. It will begin as a stand-alone 
25 system ia each aircraft, but when secure Intemet connection becomes a reality on 
aircraft, a simple upgrade will permit direct coimection to the airline company's 
central computer so that the system can be used for aircrew scheduling and other 
administrative functions. 

30 CRUPAX DFSS 30 provides airlines with a reUable method of physically 

limiting flight deck 32 access to authorized personnel only. The pilot may be 
required to activate the DFSS 30 or it may be activated automatically once the engines 
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are started prior to a flight, after which all aircrew are, in every case, required to be 
positively identified by identity verification unit 33 before entering the fligiht deck 32. 
The sj^tem 30 serves to make the aircraft flight deck 32 inaccessible to hijackers, 
making the likelihood of criminal trespass extremely remote. It therefore increases 
5 flight crew security and enables pilots to prevent potential hijackers, as well as unruly 
passengers, firom gaining access to the flight deck 32. 

The CRUPAX Flight Deck Security System (FDSS) 30 in accordance with the 
present invention can provide various levels of security for crews on flight decks as 
10 determined by the general enviromnent in which they are working. Airlines operating 
in certain countries witii specific types of aircraft will require a predetermined bvel of 
security. The FDSS 30 may be configured in several forms to provide different levels 
of security for different types of aircraft, which, as examples, will be described below 
as security levels 1, 2 and 3. 

15 

Security Level 1 - For small shuttle/commuter aircraft not equipped with a 
cockpit door 2, it may be sufficient to install only a security curtain 1 that the pilots 
can close to protect themselves fi-om physical attack. This embodiment would have a 
similar track 4 and curtain 1 assembly as described above. The curtain 1 could be 
20 opened and closed manually or electrically by a motor from the flight deck 32 side 

only. The curtain 1 may have a small viewing window or peephole so that pilots can 
see the cabin area 3 1 outside the curtain 1 . 

Security Level 2 - For medivim size commuter aircraft, it may be sufficient to 
25 combine the motorized security curtain 1 which assures a secure zone 7 at the cockpit 
door 2 with a video camera system 35, 36 which allows the pilot(s) to visually verify 
the identity of the person seeking entry onto the flight deck 32 as well as to determine 
that the person is alone in the secure zone 7 before unlocking the coclqpit door 2. This 
security level must include a lavatory 38 occupancy sensor 39 if the lavatory 38 is 
30 located within the secure zone 7. 
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Level 2 security would be appropriate in situations where there are a small 
number of flight attendants who work with the pilots on a monthly rotation so that 
they are known to each other and biometric identification is not considered necessary. 

As shown in the flow diagram in figure 7, the process for an aircrew member 
to gain entry to the flight deck under security level 2 includes the following steps: 
the member knocks on the cockpit door 2 — 71; 

- the pilot checks the video monitor to identify the aircrew member and to make 
sure the member is alone — 72; 

- when satisfied, the pilot pushes the green button and watches the curtain 1 close 
and lock - 73; 

- tiie pilot pushes the red button to unlock the cockpit door 2 - 74; 

- the member enters the flight deck and closes the cockpit door 2-75; 

- the cockpit door 2 locks - 76; 

- the curtain 1 unlocks and retracts into the container 8 - 77. 

As shown in the flow diagram ia figure 8, the process for an aircrew member 
to gain entry to the flight deck 32 under security level 2 when the lavatory 38 is 
within the secxire zone 7 differs from the process in figure 7 and includes the 
foUowiug steps: 

the aircrew member checks the lavatory 38 occupancy indicator light 40-81; 
the member knocks on the cockpit door 2 - 82; 

- the pilot checks the video monitor to identify the aircrew mranber and to make 
sxire the member is alone - 83; 

the pilot checks the lavatory occupancy light 41 - 84; 
^ when satisfied, the pilot pushes tihie green button and watches the curtain 1 close 
and lock - 85; 

- the pilot pushes the red button to unlock the cockpit door 2 — 86; 

- the member enters the flight deck and closes the cockpit door 2 - 87; 

- the cockpit door 2 locks - 88; 

the curtain 1 unlocks and retracts into the container 8 - 89. 
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Security Level 3 - For larger aircraft where aircrew numbering ten or more 
are oft^ unknown to each other, biometric identification of all aircrew members is 
crucial in order to avoid infiltration by impostors. This security level would use the 
entire Cmpax FDSS 30 described above, A lavatory 38 occupancy sensor 39 would 
5 be required in aircraft that have a lavatory 38 located within the secure zone 7. 

It should be noted that the Level 3 system does not require pilots to recognize 
the person requesting entry. In many cases the pilots do not know some or all of the 
flight attendants as they work with a different crew on almost every assigmnent, and 

10 in larger aircraft the crew may number fifteen or more. The pilots must have 

confidence in the system's ability to verify aircrew identity, and they must use the 
security camera 36 to establish that the person is alone and is not imder duress or 
acting suspiciously. The video monitor 35 will clearly show ttie entire secure zone 7, 
and the pilots will decide from what they see whether it is safe to open the door 2. If 

15 in doubt, they may delay the opening and converse with flight attendants by intercom 
until satisfied that it is safe. 

As shown in the flow diagram in figure 9, the process for an aircrew member 
to gain entry to the flight deck imder security level 3 includes the following steps 
20 where the biometric identification imit is a fingerprint scanner: 

- the member places a finger on the fingerprint scanner 33 - 91 ; 

- the controller 34 authenticates the member' s fingerprint - 92; 

- a single chime rings on the interface 37 - 93; 

- the curtain 1 closes and locks - 94; 

25 - the pilot checks the video monitor to make sure fliat the member is alone - 95; 

- when satisfied, the pilot pushes tiie red button to unlock the cockpit door 2 - 96; 

- the member enters the flight deck and closes the cockpit door 2 - 97; 

- the cockpit door 2 locks - 98; 

- the curtain 1 unlocks and retracts into the container 8 — 99. 

30 

As shown in tiie flow diagram in figure 10, the process for an aircrew member 
to gain entry to the flight deck 32 under security level 3 when the lavatory 38 is 
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within the secure zone 7 differs from fhe process in figure 9 and includes the 
following steps: 

- the aircrew member checks the lavatory 38 occupancy indicator light 40-1 00; 

- the member places a finger on the fingerprint scamer 33 — 101; 
5 - the controller 34 authenticates the member's fingerprint - 1 02; 

- a single chime rings on the interface 37-103; 

- the curtain 1 closes and locks - 104; 

- the pilot checks the video monitor to make sure that the member is alone - 105; 
the pilot checks the lavatory occupancy light 41 - 106; 

10 - when satisfied, the pilot pushes the red button to unlock the cockpit door 2 - 1 07; 

- the member enters the flight deck and closes ttie cockpit door 2-108; 

- the cockpit door 2 locks — 109; 

- the curtain 1 unlocks and retracts into the container 8 — 110. 



15 As shown in the flow diagram in figure 1 1 , the process for a non-aircrew 

member to gain entry to the flight deck 32 under security level 2 or 3, when the 
lavatory 38 is within the secure zone 7, includes the following steps: 

- the non-aircrew member desiring entry seeks and receives permission to access 
the flight deck 32 firom the pilot via the aircraft's intercom -111; 

20 - the non-aircrew member knocks on the cockpit door 2—112; 

- the pilot checks the video monitor to identify the non-aircrew member and to 
make sure that the non-aircrew member is alone - 1 13; 

the pilot checks the lavatory occupancy light 41-1 14; 

- when satisfied, the pilot pushes the green button and watches the curtain 1 close 
25 and lock -115; 

- the pilot pushes the red button to unlock the cockpit door 2-116; 

- the non-aircrew member enters the flight deck 32 and closes the cockpit door 2 - 
117; 

- flie cockpit door 2 locks — 1 1 8; 

30 - ttie curtain 1 imlocks and retracts into the container 8-119. 
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Under security levels 2 and 3, one of the pilots may wish to leave the flight 
deck 32 eiflier to go to the aircraft cabin 31 or to the lavatory 38. As well, after an 
attendant or other person has completed their task oir visit to the flight deck, they must 
be able to leave the flight deck without a breach in security. The processes for leaving 
5 the flight deck will be described with respect to a pilot leaving the flight deck, but 

applies to all others, and in relation to the configuration where the lavatory 38 is 
within the secure zone 7. 

As shown in the flow diagram in figure 12, the process for a pilot to 
10 exit the flight deck 32 includes the following steps: 

- the pilot checks the lavatory occupancy light 41 - 121; 

- the pilot views the video monitor to ensure that the area outside the cockpit door 2 
is clear- 122; 

- when satisfied, the pilot pushes the green button and watches the curtain 1 close 
15 and lock -123; 

- the pilot again views the video monitor to ensure that the secure area 7 is 
imoccupied - 124; 

- the pilot pushes the red button to unlock the cockpit door 2-125; 

- the pilot exits the flight deck and closes the cockpit door 2 - 126; 
20 - the cockpit door 2 locks - 127; 

- the curtain 1 unlocks and retracts into the container 8 - 128, 

Steps 121 and 122 could be interchanged depending on the preference of the pilot. 

When the pilot wishes to use the lavatory 38 located in the secure zone 7, the 
25 process illustrated with respect to the flow diagram in figure 13 may be used; it 
includes the following steps: 

- the pilot checks flie lavatory occupancy light 41 - 130; 

- the pilot views the video monitor to ensure fliat the area outside the cockpit door 2 
is clear - 131 

30 - when satisfied, the pilot pushes the green button and watches the curtain 1 close 

and lock - 132; 
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- the pilot again views the video monitor to ensure that the secure area 7 is. 
unoccupied - 133; 

- the pilot pushes the red button to unlock the cockpit door 2 - 134; 

- the pilot exits tiie flight deck and leaves the cockpit door 2 open - 135; 
5 - the pilot uses the lavatory 38 — 136; 

- the pilot re-enters the flight deck 32 and closes the cockpit door 2-137 

- the cockpit door 2 locks — 138; 

- the curtain 1 unlocks and retracts into the container 8 — 139. 

10 Steps 121 and 122 in jBgure 12 as well as steps 130 and 131 in figure 13 may 

be interchanged. 

The installation of a Crupax FDSS 30 on an aircraft can further provide the 
advantage of enhancing other security concerns on an aircraft. For instance, most 

15 commercial passenger aircraft have one or more doors/hatches that provide access to 

under-floor electronic bays or the cargo hold. These are usxially located in the floor 
near the firont of the cabin. An intruder may attempt to access these areas to damage 
the hydraulics, fuel lines, electronics or other vital components. These doors or 
hatches may be fitted with electronic locks which are connected into the Crupax 

20 FDSS 30 and can only be opened during a flight by one of the pilots after he/she has 

been positively identified by the identity verification unit 33. 

Further, an additional lU 33 and security curtain 1 may be located at the 
entrance to tiiie aircrew sleq)ing quarters. Most of the larger craft designed for 
25 lengthy intercontinental flights have aircrew rest areas where passengers are not 
permitted, however there is nothing to bar their entry. The additional lU 33 and 
security curtain 1, connected to the Crupax FDSS 30 controller could serve to provide 
the aircrew security and privacy while resting, as well as a safe refuge if one is 
needed. 

30 

As described above, the Crupax FDSS 30 includes a controller 34 for 
determining if access to the flight deck 32 is to be provided to a person based on a 
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biometric scan of the person seeking access. Biometric data for the person seeking 
access acquired at the identity verification unit 33 is transferred to the controller 34 
where it is compared to biometric data for aircrew to determine if the person can be 
given access to the flight deck 32. Figure 14 schematically illustrates a system 140 
5 for acquiring and distributing the biometric data for aircrew. The system 140 includes 

a number of enroUment stations 141 where each aircrew member provides a scan of 
an identifying characteristic, such as a fingerprint, that is to be used in the.Crupax 
FDSS 30. Each enrollment station 141 for acquiring biometric data includes an 
identifying characteristic scanner 144, such as a fingerprint scanner, a computer 

10 terminal 145 for controlling the scanner 144 and a high security memory 146 for 

storing the biometric data obtained fi'om the scanner 144. An enrollment station 141 
may be located in each airline crew base with a central computer terminal 147 at the 
corporate head office. In the case of Air Canada, the enrollment station 141 locations 
would be in Halifax, Montreal, Toronto, Wiimipeg, Calgary and Vancouver, with the 

15 central terminal 147 situated in Montreal In each ofBce where aircrew are hired or 

terminated, an lU enrollment station 141 would be used to fingerprint each employee 
to obtain the biometric data, which would then be stored on the computer memory 
146. All enrollment stations 141 and the central terminal 147 may be linked to each 
other by a secure communications network 148 to facilitate inter-station data transfer. 

20 The enrollment station computer 141 as well as the central terminal 147 will have a 

memory 146 with sufficient capacity to store all biometric data for the airline's 
complete aircrew work force. 

The biometric data which is stored at the enrollment staftion 141 and the 
25 central terminal 147 is transferred, in whole or in part, either physically, as by a CD, 

or electronically by secure Internet communications 143 to the Cmpax FDSS 30 in 
each of the aircraft 142 in flie fleet. The transfer is accomplished through the use of 
the communications device 42 in FDSS 30. In aircraft 142 that do not have a secure 
Internet conomunications link, flie transfer will be made physically to the aircraft 142 
30 in the area of the enrolment station 141. In the case of retrofit installations, a 

designated employee in each crew base will, on a regular schedule, interrogate the 
enrollment station 141 memory 146 and obtain an ^hxpdate" CD, smart card or USB 
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pen drive containing any changes to aircrew data tiiat have occurred since the last 
update. This data is then downloaded to each aircraft controller 34 through the 
communications device 42. This will ensure fliat data on all new hires, terminations 
and other changes are provided to each controller 34 in a timely fashion to enable 
5 recognition of new employees and rejection of tiiose terminated. 

With the introduction of seciure Intemet communications in new aircraft being 
built, the central data terminal 147 may automatically download aircrew scheduling 
information plus biometric data for only those aircrew members working on that 
10 particular flight prior to commencement of each leg of the flight. When the controller 
34 compares the scanned biometric data to the stored biometric data it will only have 
tiie biometric data for the scheduled crewmembers to check, enabling it to respond to 
a query instantly. 



15 The Crupax system as described above has many advantages.- For example, it 

1) Secures the flight deck continuously for the duration of a flight. 

2) Positively identifies all flight crew members before they enter the 
flight deck. 

3) Physically bars cockpit entry to all unauthorized personnel, 

20 4) Provides flight crew with easy, secure access to cockpit (user fiiendly). 



On the other hand, the system does not: 

1) Permit flight crews to circumvent the system undetected. 

2) Allow cockpits to be open or easily accessible at any time. 
25 3) Unduly retard crew efficiency. 

While the invention has been described according to what is presently 
considered to be the most practical and preferred embodiments, it must be understood 
that the invention is not limited to the disclosed embodiments. Those ordinarily 
30 skilled in the art will understand that various modifications and equivalent structures 

and fimctions may be made without departing from the spirit and scope of the 
invention as defined in the claims. Therefore, the invention as defined in the claims 
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must be accorded the broadest possible interpretation so as to encompass all such 
modifications and eqmvalent structures and functions. 



